Admin in English with Switch WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Admin in English with Switch plugin for WordPress, affecting all versions through 1.1. The vulnerability arises from inadequate nonce validation in the 'enable_eng' function, allowing unauthenticated attackers to alter administrator language preferences by tricking them into clicking a link.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling attackers to manipulate administrator language settings without authorization.

Reproduction

To reproduce this vulnerability, an attacker must exploit the 'enable_eng' function by sending a forged request that includes the 'data' parameter. This can be done by tricking an administrator into clicking a link that activates the request, thereby changing the language setting to English or disabling it, depending on the value of the 'data' parameter.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.